CVE Feed

Dashboard / CVE / CVE-2008-1950

CVE-2008-1950

Integer signedness error in the _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a certain integer value in the Random field in an encrypted Client Hello message within a TLS record with an invalid Record Length, which leads to an invalid cipher padding length, aka GNUTLS-SA-2008-1-3.

Published:May 19, 2008

Last Modified:Apr 23, 2026

EPS:May 21, 2008

EPSS Score:0.08239

CVSS Score:5

Affected Products

Vendor

Product

Action

Vendor

Gnu

Product

Gnutls

Gnu

Gnutls

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Exploits

No exploit reference

Common Weakness Enumeration

No CWE recorded yet

Common Attack Pattern Enumeration and Classification (CAPEC)

No CAPEC recorded yet

Related CVEs

CVE-2026-42014 (CVSS 6.6) — A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer…

CVE-2026-5419 (CVSS 3.7) — A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This…

CVE-2026-42013 (CVSS 8.2) — A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could ca…

CVE-2026-42012 (CVSS 7.1) — A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially craft…

CVE-2026-5260 (CVSS 8.2) — A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA…

CVE-2026-33846 (CVSS 7.5) — A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The iss…

CVE-2026-3832 (CVSS 3.7) — A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially craft…

CVE-2026-33845 (CVSS 7.5) — A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leadi…

CVE-2026-3833 (CVSS 6.5) — A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `n…

CVE-2026-42009 (CVSS 7.5) — A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security …

References

http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commitdiff%3Bh=bc8102405fda11ea00ca3b42acc4f4bce9d6e97b

http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00051.html

http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00055.html

http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00060.html

http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00003.html

http://secunia.com/advisories/30287

http://secunia.com/advisories/30302

http://secunia.com/advisories/30317

http://secunia.com/advisories/30324

http://secunia.com/advisories/30330

http://secunia.com/advisories/30331

http://secunia.com/advisories/30338

http://secunia.com/advisories/30355

http://secunia.com/advisories/31939

http://security.gentoo.org/glsa/glsa-200805-20.xml

http://securityreason.com/securityalert/3902

http://sourceforge.net/project/shownotes.php?release_id=600646&group_id=21558

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0174

http://www.cert.fi/haavoittuvuudet/advisory-gnutls.html

http://www.debian.org/security/2008/dsa-1581

http://www.kb.cert.org/vuls/id/659209

http://www.mandriva.com/security/advisories?name=MDVSA-2008:106

http://www.openwall.com/lists/oss-security/2008/05/20/1

http://www.openwall.com/lists/oss-security/2008/05/20/2

http://www.openwall.com/lists/oss-security/2008/05/20/3

http://www.redhat.com/support/errata/RHSA-2008-0489.html

http://www.redhat.com/support/errata/RHSA-2008-0492.html

http://www.securityfocus.com/archive/1/492282/100/0/threaded

http://www.securityfocus.com/archive/1/492464/100/0/threaded

http://www.securityfocus.com/bid/29292

http://www.securitytracker.com/id?1020059

http://www.ubuntu.com/usn/usn-613-1

http://www.vupen.com/english/advisories/2008/1582/references

http://www.vupen.com/english/advisories/2008/1583/references

https://exchange.xforce.ibmcloud.com/vulnerabilities/42533

https://issues.rpath.com/browse/RPL-2552

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11393

https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00487.html

https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00590.html

https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00615.html

http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commitdiff%3Bh=bc8102405fda11ea00ca3b42acc4f4bce9d6e97b

http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00051.html

http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00055.html

http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00060.html

http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00003.html

http://secunia.com/advisories/30287

http://secunia.com/advisories/30302

http://secunia.com/advisories/30317

http://secunia.com/advisories/30324

http://secunia.com/advisories/30330

http://secunia.com/advisories/30331

http://secunia.com/advisories/30338

http://secunia.com/advisories/30355

http://secunia.com/advisories/31939

http://security.gentoo.org/glsa/glsa-200805-20.xml

http://securityreason.com/securityalert/3902

http://sourceforge.net/project/shownotes.php?release_id=600646&group_id=21558

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0174

http://www.cert.fi/haavoittuvuudet/advisory-gnutls.html

http://www.debian.org/security/2008/dsa-1581

http://www.kb.cert.org/vuls/id/659209

http://www.mandriva.com/security/advisories?name=MDVSA-2008:106

http://www.openwall.com/lists/oss-security/2008/05/20/1

http://www.openwall.com/lists/oss-security/2008/05/20/2

http://www.openwall.com/lists/oss-security/2008/05/20/3

http://www.redhat.com/support/errata/RHSA-2008-0489.html

http://www.redhat.com/support/errata/RHSA-2008-0492.html

http://www.securityfocus.com/archive/1/492282/100/0/threaded

http://www.securityfocus.com/archive/1/492464/100/0/threaded

http://www.securityfocus.com/bid/29292

http://www.securitytracker.com/id?1020059

http://www.ubuntu.com/usn/usn-613-1

http://www.vupen.com/english/advisories/2008/1582/references

http://www.vupen.com/english/advisories/2008/1583/references

https://exchange.xforce.ibmcloud.com/vulnerabilities/42533

https://issues.rpath.com/browse/RPL-2552

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11393

https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00487.html

https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00590.html

https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00615.html

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High